Every pull request reviewed before it merges

Two concurrent requests can both pass the balance check before either writes, so a workspace with 40 credits can start two 40-credit runs. The read and the write are separate statements with no lock and no transaction between them.

Credits are the billing unit, so this is unmetered consumption of paid compute. It is reachable by any authenticated customer with two clients and no special access, and it leaves no anomaly in the ledger — both writes are individually valid.

deductCredits reads the balance with a plain SELECT at line 69 and writes the decremented value at line 79. Nothing holds a row lock across the two, and the enclosing handler does not open a transaction, so two callers interleave read-read-write-write and the second write overwrites the first. FOR UPDATE on the read, or a single conditional UPDATE … WHERE balance >= :cost, closes it.

The agent read the diff and the two files it touches. It did not run the service: this is a static finding about a code path, graded on reachability from an authenticated route, not a reproduction against a deployed environment.